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PREFACE 


Initial funding for this study began m October 1976 under the 
NASA Terminal Configured Vehicle (ATOPS) program. The main effort was 
directed toward the application of a variation of a partitioned adaptive 
control algorithm to the dynamics of a B-737 aircraft. The special 
control law was one which could accommodate nonlinearities in the aircraft 
dynamics. Particular emphasis was placed on the problem of guiding the 
craft on optimum landing trajectories to provide quicker and safer land- 
ing approaches in adverse weather conditions. The details of this control 
law and its development were reported in interim unpublished reports 
dated 10/77 and 5/78. This work was done with the help of P. E. Zwicke. 

Subsequently, with some shifts in personnel the project was 
continued with some refinements in the main control law. Some in- 
efficiency was incurred through the natural difficulty of transferring 
computer code from one user to another. The emphasis was on simulation 
of nonlinear measurements, incorporation of a realistic wind shear and 
gust model and model reduction using a known correlated input as a 
pseudo-input to each configuration model. These aspects were reported 
on 2/79. 

The project then suffered some delay and redirection. Taking 
over from William Lucas was Joel Brinkley. Joel's interest lay in 
studying the detection of failures m the control system. This 
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last phase of the project is reported herein and provides a com- 
pletion of the project ( 8 / 82 ). 

All of the investigators would like to take this opportunity to 
thank the associated NASA personnel for their support and encour- 
agement; in particular, Dr. T. M. Walsh for his confidence in get- 
ting our project started, Dr. J. R. Creedon for the bulk of the 
technical guidance and patience with our staffing problems and R. 
M. Hueschen and Nesim Halyo for their assistance and work on the 
technical aspects. 
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1 . INTRODUCTION 


One of the major goals of the NASA Terminal Configured Vehicle 
(TCV) project is automatic control of aircraft in adverse weather for 
i quicker, safer landings. The ATOPS B-737 was chosen for the program 
because of its nonlinear flight envelope. In addition to the nonlinear 
plant, some of the aerodynamic parameters are only partially known which 
makes it a difficult control problem. This part of the problem has 
been solved by Zwicke and Lucas (14,15,16); however, the effect of 
actuator and sensor failures was not explored. Sensor and actuator 
failure detection and compensation is an extremely important part of 
the overall aircraft control because if a failure is not detected and 
the controller is not properly compensated, the flight may end disas- 
trously. In this thesis only the failure detection problem is under- 
taken except to show that the estimator part of the control algorithm 
used by Zwicke (14,16) can adapt to properly modeled sensor failures. 

The first method to be used for failure detection is the configu- 
ration detection algorithm from the Modified Partitioned Adaptive 
Controller (14) . This method uses a bank of parallel Kalman filters 
to predict the state of the various configurations and determines the 
correct configuration by the whiteness of the noise in the filter 
residue. The failure detection technique is tested to determine the 
types of failures it will detect and under what conditions this detec- 
tion occurs. The most important criterion is the detection technique's 
ability to accurately and quickly determine actuator and sensor failures 
in the presence of sensor noise with inaccuracies in the plant model. 
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The second method to be used for failure detection is the failure 
detection filter, FDF, technique developed by Beard (1) and Jones (2). 
Since this failure detection technique was developed, little work has 
been done on estimation theory to determine how the noisy plant output 
is associated with the line or plane characteristic of a failure. A 
solution to this problem is presented and the FDF technique is tested 
with the same failures and conditions as the first method. Again the 
most important criterion is the FDF technique's ability to detect fail- 
ures in the presence of noise with inaccuracies in the plant model. 

In the past a number of different techniques have been used to 
detect actuator and sensor failures. The primary emphasis has been to 
detect sensor failures. The simplest schemes involve redundant hard- 
ware; but with the development of the computer, more and more schemes 
have been developed which depend on computational algorithms rather 
than redundant hardware to detect failures. Only a brief summary of 
the work done in the past on failure detection is presented here. A 
detailed summary of the different failure detection techniques can be 
found in (3) . 

Voting schemes are the simplest sensor failure detection scheme. 

In most voting schemes the output of three or more redundant sensors is 
compared. If the output of one of the sensors differs from the others, 
it is declared failed and removed from future consideration. This 
method is easy to implement, but can not detect soft failures or small 
biases and does not take advantage of information available from non- 
identical sensors. The following papers give examples of this method 
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(4,5, 6, 7). A modification of this method involves two sensors compar- 
ing outputs and if a difference arises, an analytical method is used 
to determine which sensor has failed. This reduces redundant hardware 
but at the cost of increased complexity. Work in this area has been 
done by Deckert, et al. (8). Another modification of the straight 
voting procedure is the method developed by Chien (9) . This method 
uses a time weighted average of measurement errors to detect failures 
that memoryless voting schemes would miss. 

In addition to voting schemes, a large number of failure detection 
techniques have been developed based on the likelihood ratio developed 
by Van Trees (10). The extension of this, the Generalized Likelihood 
Ratio or GLR, has been used in many applications because it is optimal 
in a statistical sense; however, it can become extremely complex and 
this is its major limitation. Caglayan and Montgomery (11,12) devel- 
oped a technique using a bank of parallel Kalman filters to predict 
the state of all possible failure modes and used the GLR to find the 
probability of each configuration. Various other methods have been 
employed to reduce the complexity of the full GLR method and a good 
synopsis of these is done by Willsky (3) . 

Another method to detect actuator and sensor failures is the 
Failure Detection Filter, FDF, technique developed by Beard (1). This 
failure detection method can detect a wide range of failures in 
actuators and sensors or dynamic changes in one element of the system 
dynamics matrix or the input coefficient matrix. The filter is 
designed so that in the no failed state the filter estimator tracks 
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the state estimator. When a failure occurs, the filter is designed 
to accentuate the failure in a predictable manner in the filter 
residual. A design algorithm was developed for continuous, linear, 
time-invariant, deterministic systems. Jones (2) extended the FDF 
method to stochastic and discrete systems. He also demonstrated that 
the FDF could be used as a suboptimal state estimator. 



2. KALMAN FILTERS FOR FAILURE DETECTION 


2.1 Introduction 

The Kalman filter has been used for a number of years for a variety 
of applications. Its wide use is due primarily to its predxction cor- 
rection structure for state estimation and its noise filtering capa- 
bilities. The Kalman filter is optimal in the sense that it minimizes 
the mean square error. In this chapter the Kalman filter is used to 
predict the state of various plant models in the presence of white 
noise. The whiteness of the filter residue, the plant output minus 
the output predicted by the Kalman filter, is used to determine the 
actual configuration. 

The decision theory used in this chapter was presented by Moose 
and Wang in (13) and was developed for randomly switching plant con- 
figurations. These randomly switching plant configurations may be 
actuator or sensor failure models as long as the system remains observ- 
able and controllable after the failure. 

One of the purposes of this chapter is to review the B737 project 
sponsored by NASA and show that the algorithm developed by Zwicke (14) 
can adequately control the aircraft after a sensor failure. The other 
purpose of this chapter is to show that the method developed by Zwicke, 
Moose, Wang, et al. (13,14) can be modified to detect both sensor and 
actuator failures and present an example for simulation. 
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2.2 The Structure of the Kalman Filter 

The discrete time description of a linear system corrupted by 
noise is 

x(k+l) = Ax(k) + Bu(k) 4- Gw(k) (2.2.1) 

y(k) = Cx(k) + Hv(k) (2.2.2) 

where, 

x is an n*l state vector 

u is an m*l input vector 

y is an r*l output vector 

w ' is an n*l input disturbance vector 

v is an r*l measurement noise vector 

A is an nxn system dynamics matrix 
B is an n*m input coefficient matrix 
C is an rxn measurement coefficient matrix 
The vectors w and v are zero mean white Gaussian processes with vari- 
ances Q and R respectively. 

The Kalman filter is described by equations, 

z(k+l/k) = Az(k) + Bu(k) (2.2.3) 

z(k+l) « z(k+l/k) + K(k+1) [y (k+1) - Cz(k+l/k)] (2.2.4) 

The Kalman filter gain K is calculated as follows 

M(k+1) = AP(k)A T + GQG T 


(2.2.5) 
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K(k+1) = M(k+l)C T [CM(k+l)C T + HRH 1 ]” 1 (2.2.6) 

P(k+1) * [I - K(k+l)C]M(k+l) [I - K(k+1)C] T + K(k+l)HRH T K T (k+l) (2.2.7) 
2.3 The B737 Project 

A major goal of the NASA Terminal Configured Vehicle (TCV) project 
is automatic landing of aircraft in adverse weather on a predetermined 
glideslope with a linear decrease in both velocity and altitude. The 
automatic control is complicated by the nonlinear dynamics of the air- 
craft and the fact that many of these dynamics are not precisely known. 
In addition many aerodynamic coefficients are in tabular form and some 
of these are only estimated. The nonlinear measurement model and 
measurement errors further complicate the problem. 

In the past, work has been done by Moose, VanLandingham, Zwicke 
and Lucas (14,15,16) on the control of the longitudinal dynamics of the 
B737 ignoring the possibility of a sensor failure. The goal of this 
part of the project is to show that satisfactory control of the air- 
craft can be maintained after a sensor failure. 

In this section there is a brief review of the work done by Zwicke 
(14) and a development of the sensor failure model. 

2.3.1 The B737 Model 

The B737 is a highly nonlinear plant and is linearized about ten 
operating points using Taylor Series Expansion. From these ten plant 
models the longitudinal dynamics of the airplane can be adequately 
represented for the adaptive control algorithm. The assumptions that 
are made to further simplify the problem are: 
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1) Control inputs are elevator perturbation and throttle rate. 

2) All lateral variables and their rates are small such as yaw, 
roll and sideslip. 

3) The pitch angle is small. 

4) All equations are linearized around 

u q steady state inertial speed x-direction 
v q steady state inertial speed z-direction 

0 q steady state pitch angle 

5) Perturbations of the pitch angle, 8, are small so cos8 = 1 
and sin6 ' 8. 

The B737 plant model is described by equations (2.2.1) and (2.2.2). 
The system dynamics is represented by fourteen state variables. Nine 
of these correspond to plant states and the other five state variables 
were added for the simulation of correlated wind gusts. The input 
coefficient, B, matrix has two rows: one indicating the effect of the 

throttle rate on the system and the other the effect of the elevator 
perturbation on the system. The measurement coefficient, C, matrix is 
a nonlinear combination of the states. It has been linearized about an 
operating point and is accurate for small values of noise. 

2.3.2 The B737 Controller 

The control technique used in the B737 project is the Modified 
Partitioned Adaptive Controller or MPAC developed by Zwicke (14). The 
controller computes a system input based on the plant configuration 
and the reference input. A bank of parallel Kalman filters operates 
independently on noisy measurements. Each filter produces a state 
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estimate Z^(k+1). This state estimate is multiplied by a feedback gain 
calculated for the i*"* 1 configuration. In addition to the state vari- 
able feedback, two other terms must be added to the input for each 
configuration. The reference input, q, is scaled so that zero steady 
state error can be achieved, and a linearization constant from the 
Taylor Series Expansion associated with each model must be added. 
Therefore, the input is of the form 


U ± (k) = F ± (k)Z i (k) + H.q + T ± (2.3.1) 

where 

th 

IL(k) is the input calculated for the i configuration 

F^(k) is the time varying feedback gain for the i C ^ configuration 

Z^(k) is the Kalman estimate for the i C ^ configuration 

is the scaling constant for zero steady state error 
q is the reference input 

th 

T^ is the Taylor Series Expansion constant for the i 

configuration 

In order to calculate the overall system input a weighted sum of the 
individual inputs is computed. The weighting coefficients are 
calculated as follows. 


II (k+1) 


C(k+1) 


P.CrCk+l)) 0 

X • • • 

• • • 

0 p (r(k+l» 

m 





0 

mm 


Il(k) (2.3.2) 


where 


P i (r(k+1)) = P i (y(k+1)/S(k+1) = S i (k), y (k) ) 


(2.3.3) 
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and 

is a semi-Markov transition parameter 
is a normalizing constant 

is a vector containing the probability of each plant 
configuration 

th 

is the plant output minus the i filter output 
The probability density p (y (k+1) /S(k+1) = y(k)) is approximated by 

a Gaussian density for the cases where the probability of transition 
between adjacent samples is small and is given by 


C(k+1) 

n(k+i) 

r.(k+l) 


P 1 (r i (k+1)) = D. exp {-1/2 r. T (k+l) v/* 1 r^k+1)} (2.3.4) 


where. 


cti 

is the measurement residual covariance for the i filter 


D ± - <2H)“ M/2 iv.r 1/2 


(2.3.5) 


The semi-Markov transition probabilities 0 in (2.3.2) represent the 
probability of changing from configuration to . An excellent 
discussion of how to choose the semi-Markov matrix can be found in 
(14). When the largest weighting coefficient IL (k+1) falls below a 
predetermined threshold, the Kalman gains for all the configurations 
are reset in order to improve the convergence of the filters when 
the plant moves from one configuration to another. This threshold is 
found by trial and error and is dependent primarily on the signal to 
noise ratio. 

2.3.3 The Sensor Failure Model for B737 

A sensor failure is modeled as zero output from the failed sensor 
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which is equivalent to a zero row in the C matrix in equation (2.2.2). 
The sensor failures that were included as possible configurations were 
those which (A, C) from equations (2.2.1) and (2.2.2) remained an 
observable pair after the sensor failure. 

2.4 Actuator and Sensor Failure Detection using Kalman Filters 

The Kalman filter approach to detecting failures has many similar- 
ities to the estimator part of the MPAC developed in the last section. 
The Kalman filter approach to detecting failures developed in this 
thesis is a slight modification of the work done by Moose and Wang 
(13). 

The method developed in this section can detect sensor or actuator 
failures in a system which is observable after the failure. For each 
failure a model is developed. The actuator and sensor failure models 
are developed in sections 3.4.1 and 3.4.2 respectively. A bank of 
parallel Kalman filters, one filter for each possible failure mode, 
is run with each filter independent of the others. The filter residue 
from each filter is then used to compute the probability of that state, 
using equation (2.3.2). As in the MPAC when the largest probability 
II^k+1) falls below a predetermined threshold, the Kalman gains are 
reset to improve convergence. 

2.4.1 Actuator Failure Model 

A failure in the i C ^ actuator is modeled for the Kalman filter 
detection technique by modifying the i 1 "* 1 column of the B matrix, b^. 

A constant bias is modeled by multiplying b^ by a constant not equal 
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to one. The magnitude of the bias is one minus the constant multi- 
plier. A zero failure is modeled by replacing b^ by a vector with 
all zero entries. 

2.4.2 Sensor Failure Model 

til 

A failure in the i sensor is modeled for the Kalman filter 
detection technique by modifying the i^ row of the C matrix, C^. A 
constant bias is modeled by multiplying by a constant. The magni- 
tude of the bias is found exactly as it was in section 2.4.1. A zero 
failure is modeled by replacing with a vector containing all zeros 
and a soft failure in the i^ sensor is modeled by increasing the i C ^ 
diagonal element H which increases the noise on the i^ sensor. 

2.4.3 Boiler System Example El 

This is an example of a boiler system that might be used on board 
ship and is adapted from an example in (17) . There are two boilers on 
board but only one will be modeled. It is assumed that the other is 
operating at steady state and at the desired operating point. There 
are three states of interest: 1) pressure deviation, P, around 20 

bars; 2) temperature deviation, T, around 300°C; 3) the integral of 
the energy/KG of the superheated steam about the desired operating 
point (20 bars and 300°C) . The control implemented would try to keep 
P and T at the operating point and keep the integral of the steam 
energy zero; however, in this thesis only detection of an actuator 
or sensor failure is considered. 

The three inputs to the system are fuel, superheated steam and 
saturated steam. The steam can be considered an input when it is 
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used to preheat the boiler or to meet the operating conditions when 
there is a zero or low fuel rate to the boiler. 

The continuous time system is modeled 

x = Ex + Fu (2.4.1) 

y ■ Cx (2.4.2) 


where the state variables in the vector x are 

x^ is the deviation of pressure around 20 bars in the boiler 

x 2 is the deviation of the output temperature around 300°C 

x^ is an intermediate variable 

x^ is MJ/kg of energy in the steam integrated over time 
and the inputs u are defined 

u^ is the flow rate of fuel (Mg/hr) 

U£ is the flow rate of superheated steam (Mg/hr) 

u^ is the flow rate of saturated steam (Mg/hr) 

The continuous model matrices are 


E 


0 

0 

0 

0 

0 

-1/154 

-1/154 

0 

0 

0 

-1/183 

0 

00338 

.02363 

0 

0 


396xl0 -3 325xl0 -4 -325xl0 -4 

1250/154 1.7 -629.35x10' 

0 1375/83 -662.65 


(2.4.3) 


(2.4.4) 


0 


0 


0 
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110 1 


C 


3 10 1 


2 111 


(2.4.5) 


The continuous time system is converted to a discrete time system 
with a forty-second sampling time. The discrete time model is given by 


where 


x(k+l) » Ax(k) + Bu(k) + Gw(k) 
y (k) - Cx(k) + Hu(k) 


A 


10 0 0 

0 .77125 -.1796 0 

0 0 .61759 0 

1352 .832419 -.09633 1 


B 


15.84 

285.935 

0 

140.98 


1.3 -1.3 

-7.65 ‘ 2679.275 

525.812 -21032.44 

6.998 893.619 


C - 


1 

3 

2 


1 

1 

1 


0 

0 

1 


1 

1 

1 


( 2 . 2 . 1 ) 

( 2 . 2 . 2 ) 


(2.4.6) 


(2.4.7) 


(2.4.8) 


Below are examples of the system with a 10% bias failure for both 
an actuator and sensor failure. Other failures are modeled similarly 
following the rules in section 2.4.1 or 2.4.2. A 10% bias failure in 
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the fuel flow rate, actuator one, is modeled by letting B become B' 
where B ' is 

1.3 -1.3 

-7.65 2679.275 

(2.4.9) 

525.812 -21032.44 

6.998 893.619 _ 

A 10Z bias in the first sensor is modeled by letting C become C' where 
C' is 

1.1 1.1 0 l.l“ 

3101 (2.4.10) 

2 111 





3. FAILURE DETECTION FILTERS FOR FAILURE DETECTION 


The failure detection filter, FDF, was first developed by Beard (1) 
for continuous, deterministic, time-invariant, linear systems. Jones 
(2) extended the FDF theory to include discrete and stochastic systems. 
However, since this work was done, very little research has been done 
either on further development or application of FDF theory. In this 
chapter the basic concepts and design algorithms are presented so that 
a reader will have the tools to design and use FDF's to detect actuator 
or sensor failures. In addition a configuration estimation technique 
is developed that gives the probability that a noisy plant output is 
associated with a line or plane characteristic of an actuator or sensor 
failure. 

3.1 Development of Actuator and Sensor Failure for Rank of C Greater 

Than or Equal to N 

The purpose of this section is to give an introduction to the 
failure detection filter. The case demonstrated in this section, the 
rank of the measurement coefficient matrix greater than or equal to 
the rank of the system dynamics matrix, demonstrates many of the basic 
concepts in failure detection filters. A more complete development of 
the topic may be found in (1,2). It should be noted that the failure 
models shown in this section are valid for C of any rank. 

The plant model used in this section is found in equations (2.2.1) 
and (2.2.2); however, v(k) and w(k) will be identically zero. 

The failure detection filter equation is 
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z(k+l) » Gz(k) + Dy (k) + BFuD(k) (3.1.1) 

where (3.1.1) is valid for C of any rank and (3. 1.2-6) are valid for 
Rank[C] greater than or equal to n. The parameter G is defined 

G - A - DC (3.1.2) 

G - cl (3.1.3) 

where |a| must be less than one for a stable filter. The detector 
gain D is defined for m=n 

D * (A - G)C _1 (3.1.4) 

or for m > n 

D ** (A - G)(C T C) _1 C T (3.1.5) 

and BF is defined 

BF - B (3.1.6) 

It is important to note that, for the rank of the C matrix 
greater than or equal to n, equations (3. 1.1-6) yield a filter that 
will detect any single actuator of sensor failure. 

3.1.1 Actuator Failure 

A failure in the i actuator is modeled 

u(k) ** uD(k) + e^ n(k) 


(3.1.7) 
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where 

uD(k) is the desired control input 

n(k) is an arbitrary function of time sampled at 

and 



where the 1 is in the i 11 * 1 position. 

Example E2 is an example of an actuator failure with 
equal to n. Assume, 


C - I 

and the FDF is defined by equation (3.1.1) 

z(k+l) - Gz (k) + Dy (k) + BFuD(k) 

y(k) - x(k) 

G ■ ol 


where 


D *» A - ol 


- kT 

(3.1.8) 


the rank of C 

(3.1.9) 

(3.1.1) 

(3.1.10) 

(3.1.11) 

(3.1.12) 


BF * B 


(3.1.13) 
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u(k) = uD(k) + er^ n(k) (3.1.14) 

The FDF residue is 

e (k+1) - x(k+l) - z (k+1) (3.1.15) 

where this can be expanded to 

e(k+l) ■ Ax(k) + Bu(k) - Gz(k) - Dx(k) - BFuD(k) (3.1.16) 

e(k+l) “ Ax(k) + BuD(k) + Ber^ n(k) - 

alz(k) - (A - al)x(k) - BuD(k) 

“ alx(k) + Ber^ n(k) - alz(k) 

= al(x(k) - z(k)) + b^ n(k) 

where 

b ± - Ber ± (3.1.20) 

The solution to equation (3.1.19) is 


. k-i 

e(k) - (ol) e(0) + J 

(al) k-j-1 b ± n(j ) 

(3.1.21) 

3-0 



. k-l 

“ (o; e(0) + l 

(ol)^ -1 b. n(J) 

(3.1.22) 

3=0 



. k-l 

- o e(0) + b. 1 

(o)^' 1 n(j ) 

(3.1.23) 


j-0 


The steady state solution to (3.1.23) is 


k-i 

e(k) = b, l (oI) K “ J " A n(J) 
1 j-0 


(3.1.17) 

(3.1.18) 

(3.1.19) 


(3.1.24) 
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It should be noted that is a vector and the rest of equation 
(3.1.24) is a scalar and that if n(k) is a constant then 

k-1 

lim £ a J n(j) = constant (3.1.25) 

k— j=0 

Also, it can be shown that in equation (3.1.22), e(k) does not depend 
on the rank of C and is valid for any C if a I is replaced by (A-DC) 
in that equation. 

However, c (k) is not an accessible signal. The accessible signal 
is 

e'(k) = Ce(k) (3.1.26) 

= y(k) - Cz(k) (3.1.27) 

k-1 . , . 

- Cb. I n(j ) (3.1.28) 

j-0 

Therefore, the error vector Cb^ is indicative of a failure in the i C ^ 

actuator for C of any rank and the magnitude of the failure may give 

information about the nature of, the failure. It can easily be shown 

th 

that in order to identify a failure in the i actuator, Cb^ must be 
independent of Cb^ for all j/i. If there are two dependent vectors 
Cb^ and Cb^ , i not equal to j , then the direction alone will not supply 
enough information to determine which actuator has failed. 

3.1.2 Sensor Failure 
A failure in the i^ sensor is modeled 

y(k) = Cx(k) + enu n(k) 


(3.1.29) 
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where n(k) is an arbitrary function of time sampled at t=*kT and 



where 1 is in the i C ^ position. 

Example E3 is an example of the i*"* 1 sensor failing with the rank 
of C equal to n. Assume 


C = I (3.1.31) 

The FDF is defined by equation (3.1.1) 

z(k+l) = Gz(k) + Dy(k) + BFu(k) (3.1.1) 

where G, D and BF are defined by equations (3.1.11-13) and where u(k) 
is the desired input defined 

u(k) - uD(k) (3.1.32) 

The sensor outputs are defined by (3.1.29). The FDF residue is 

x(k+l) - z(k+l) ■ Ax(k) + Bu(k) - 

[olz(k) + D(x(k) + enu n(k)) + Bu(k)j (3.1.33) 

e(k+l) = oI(x(k) - z(k)) - Denu n(k) 


(3.1.34) 
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e(k+l) = al e(k) - Dem^ n(k) 


The solution to equation (3.1.35) is 


k-1 


e(k) = o k e(0) - £ a k ^ 1 Dem, n(j) 

j=0 


The settled out signal is 


k-1 


e(k) : - Dem, £ 
j=0 


k-j-1 ... 

o J n(j) 


As in the actuator failure case, e(k) is not accessible. The 
signal is 

e' (k) = y(k) - Cz(k) 


e' (k) = Ce (k) - em^ n(k) 


k-1 


•CDem. £ (oI) k ^ 1 n(j) + em. n(k) 
j«=0 


since 


then. 


and letting 


D = A - al 


Denu * (A - al)em^ 


Aem.^ " a.^ 


k-1 i, • i 

: ' (k) “ a . I a k ~j -1 
j=0 


n(j) + 


k-i , 

n(k) + l a J n(j ) 
j=0 


em. 


(3.1.35) 

(3.1.36) 

(3.1.37) 
accessible 

(3.1.38) 

(3.1.39) 

(3.1.40) 

(3.1.12) 

(3.1.41) 

(3.1.42) 

(3.1.43) 
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It can be shown chat equation (3.1.40) is valid for any C if ol is 
replaced by A-DC. 

The error vector associated with a sensor failure can only be 
constrained to a plane determined by CDen^ and em^ and it can be shown 
that this plane is characteristic of a failure in the i C ^ sensor for C 
of any rank. The sensor failures are detectable even when two or more 
error planes intersect except when one of the two following cases 
occurs: 1) the error planes are coincident; or 2) the error signal 

maintains a fixed direction coincident with the intersection of the 
two planes . 

3.2 Fundamental Background for Rank C Less Than N 

This section is intended to present the basic concepts of the work 
done by Beard (1) and Jones (2) on failure detection filters. The 
proofs and underlying theory will not be presented and can be found in 
(1,2). The goal of this section is to develop the background material 
needed for designing FDF for either actuator or sensor failures where 
the rank of C is less than n. The actual design algorithms for 
actuator and sensor failures are presented in sections 3.3 and 3.4. 

The background material starts with the definition of the error 
vector e(k+l) and f the failure vector associated with a particular 
failure: 


e(k+l) = Ge(k) + fn(k) 


(3.2.1) 


where 


G - A - DC 


(3.1.2) 
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is the filter dynamics matrix and n(k) is defined in equation (3.1.7) 
or (3.1.29) and f is given by one of the two following cases: 

1) f = b. 

l 

for effector failures (3.2.2) 

2) f » Dem^ 

for sensor failures (3.2.3) 

An event associated with the vector f in equation (3.2.1) is 
defined to be detectable if there exists a matrix D, the filter gain, 
such that 

1) Ct(k) maintains a fixed direction (actuator failure) or 
plane (sensor failure) in the output space. 

2) All eigenvalues of (A-DC) can be specified almost arbitrarily. 
Condition 1) should be self-explanatory and condition 2) is necessary 
in order to insure a stable filter and to give the designer freedom to 
change eigenvalues of the filter in order to improve the filter’s per- 
formance in a noisy environment. 

The detection space of f is defined as the controllable subspace 
of G with respect to f. The dimension of the controllable subspace of 
f with respect to G is v. 

The n-vector g is defined to be the k*"* 1 order detection generator 
for f if the following conditions are met: 
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1 ) 


C 

CA 

L‘ 


k-2 


(3. 2 . A) 


2) CA 1 "" 1 g 5* 0 (3.2.5) 

3) f = o^g + ... + ct^^A 1 " 2 g + A k 1 g (3.2.6) 

if Cf j* 0 and where , ...» 

are scalars 

If g is a k tk order detection generator and k eigenvalues of A-DC 
are associated with the controllable space of f, then any solution of 


DCf 


P x g + P 2 Ag 


, n A k-1 k 
+ P A g + A g 


(3.2.7) 


will be a detector gain for f. The eigenvalues associated with the 
controllable space of A-DC are given by 

z k + P^ 1 "" 1 + ... + P 2 z + P JL - 0 (3.2.8) 

where P^ are scalars and z is the z-transform variable. 

The general solution to equation (3.2.7) is 

D - QD[(Cf) T Cf]" 1 (Cf) T + D ' { I - Cf[(Cf) T Cf] -;L (Cf) T } (3.2.9) 


where 

QD - P^g + P 2 Ag + ... + P k A k-1 g + A k g (3.2.10) 

and D' is the freedom left in D after D has been constrained to be a 
detector gain for f. It can be shown that the number of eigenvalues 
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of A-DC which can be changed arbitrarily with D' is n-v and the number 
of eigenvalues specified by QD is k. Therefore, v-k eigenvalues are 
not under the control of the designer. This result will become impor- 
tant later. 

The following definitions are made, in part, so that it can be 
determined how many eigenvalues of A-DC are free after constraining D 
to be a detector gain for f. 

A' - A - QD[ (Cf ) T Cf ] _1 (Cf ) T (3.2.11) 

C' = [I - Cf [ (Cf ) T Cf ] _1 (Cf ) T ] C (3.2.12) 

K = A - Af [(Cf) T Cf] -1 (Cf) T C (3.2.13) 

(3.2.14) 

(3.2.15) 

(3.2.16) 

(3.2.17) 


M' 


M’ 


C’ 

c'a' 


C'A' n_1 


or 

'C 

C'K 


C * K n_1 


q' = rank [M'] 


v “ n - q 


where v is the detection order of f. 
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It has been shown that 


A' - D’C* - A - DC (3.2.18) 

where D' is the arbitrary matrix of equation (3.2.9), The unobservable 
space of (A', C') is associated with the eigenvalues which were con- 
strained by making D a detector gain for f. Therefore it follows that 
the detection space of f is the null space of M' . The dimension of 
the detection space of f, v, is defined to be the detection order of f. 

It was noted earlier that if the detection order of f, v, is not 
equal to the order of the detection generator, k, then some of the 
eigenvalues of A-DC will not be under the control of the designer. 
Therefore a generator of order v, called a maximal detection generator 
or just a maximal generator, must be found in order to have full 
control over the eigenvalues. It has been shown that if (A, C) is an 
observable pair, then a maximal generator exists and is unique. 

Appendix A describes the procedure for finding the maximal generator. 

If (A, C) is not an observable pair and the error residue does not lie 
in the unobservable space, then a detection filter gain D for f may be 
found but n-q'-k eigenvalues of the filter will be uncontrollable. 

The theory developed so far applies to detection of a single 
failure f. The background material covered in the rest of this section 
is for multiple failure detection with a single filter. 

The vectors {f^, f^, ..., f } are defined to be output separable 
if 


Rank[CF] ** r 


(3.2.19) 
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where F is the nxr matrix 

u i u 

F - [A X f r ..., A r f r ] (3.2.20) 

with u^ for each defined by 

CA J f i - 0 j « 1, ...» u-1 (3.2.21) 

u i 

CA f ± j* 0 (3.2.22) 

If two vectors are not output separable, then one of two cases must 
hold: 

1) The two vectors have the same detection space and a detector 
gain for one is a detector gain for both. 

2) The two vectors do not have the same detection space and can 
not be detected by the same filter. 

The requirements for detection of more than one failure with a 
single filter are the same as for a single failure detection filter. 

The vectors {f^, ...» f } are defined to be mutually detectable if 
there exists a D which satisfies the following conditions. 

1) Ce(t) maintains a fixed direction in the output space 
(actuator failure) or stays in a fixed plane (sensor failure) . 

2) All eigenvalues of A-DC can be specified almost arbitrarily. 
The detector gain D that will constrain the error residue to a 

direction or plane can be found by solving the following equation 

D - QD[(CF) T CF] _1 (CF) T + D’{I - CF[(CF) T CF] _1 (CF) T ) 


(3.2.23) 
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where the eigenvalues of A-DC associated with constraining D to be a 
detector gain for F are fixed by the following equation 

QD « [wd^ .... wd^_ ] (3.2.24) 

where 

k -1 k 

wd ± ■ P il g ± + ... + P ±k A 1 g ± + A i g i (3.2.25) 

and g^ is the maximal generator. The scalars [P^, . .., P^ k ] are 

~ ^ i 

defined by 

k k^-1 

z A + P ±k z A + ... + P_ Ll z + P i2 - 0 (3.2.26) 

i 

where z is the z-transform variable. As in the single failure 
detection case D* is the freedom left in D after D has been con- 
strained to be a detector gain for F. 

Definitions similar to equations (3.2.11-16) are needed to deter- 
mine how much freedom will be left in the eigenvalues of A-DC after 
constraining D to be a detector gain for F. 

C' - I - CF[(CF) T CF] -1 (CF) T C (3.2.27) 

K - A - AF[(CF) T CF] _1 (CF) T C (3.2.28) 

(3.2.29) 


MG' 


C' 

C'K 


C'K n_1 


qg' “ rank [MG'] 


(3.2.30) 
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The group detection order, gdo , of {f , f^} is 

gdo = n - qg' (3.2.31) 

In the equation (3.2.23) it can be shown that the number of 

r 

eigenvalues which are fixed when QD is found is £ v . . Similar to 

i-1 

the single filter case, qg’ is the number of eigenvalues which can be 

r 

specified by arbitrary choice of D' . Therefore, n - £ v. - qg' is 

i=l 1 

the number of eigenvalues not under the control of the designer. 

These eigenvalues can be found. The algorithm for determining them 

may be found in (1) . The designer will have control over all the 

eigenvalues if and only if the group detection order, gdo, is equal 

r 

to the sum of the individual detection orders, [ v.. 

i=l 1 

3.3 Failure Detection Filter Design for Actuator Failures 

This section is a step by step guide to designing FDF of the 
form of equation (3.1.1) for multiple actuator failures and is 
derived from (1) . The design of single failure filters is similar 
except that steps 2, 3, 5 and 7 are not needed. 

The failure of the i 1 "^ actuator is associated with b., the i tfl 

l 

column of B, where 

B - [b 1 b r ] (3.3.1) 

The following steps are a guide to designing the one or more FDF's 


needed to detect an actuator failure. 
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1) If any 



replace by A^b^ where u Is defined by 

CA^b i = 0 j = 0 u— 1 

CA U b i 0 


2) Form F 


F 



U 2 

A 



(3.3.2) 


(3.3.3) 

(3.3.4) 


(3.3.5) 


3) Find the rank of CF and if it is less than r divide the set 
into two or more subsets until the rank of each set is the 
same as the number of vectors in it. If the rank of CF 
equals r, then f is output separable. 

4) Determine the maximal generator and the detection order, 
v^, for each f^ in F. If two or more f^ have the same 
detection spaces, only one of them needs to be considered 
in the following steps. Any detection filter for one such 
vector will be a detection filter for all. 

5) Determine C', K, MG’ and qg' for F using equations (3.2.27- 
3.2.30). 

6) Determine C' , K and M' for each f^ using equations (3.2.12- 
3.2.14). 

r 

If the group detection order n-qg' is not equal to £ v , 

i-1 


7 ) 
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i) Divide the set into two or more sets and find C', K, 

MG' and qg' for the new set F. 

r 

ii) See if the group detection order equals [ v.. 

i=l 1 

iii) Repeat the process if the group detection order of 

r 

the new set F is not equal to £ v . . 

1=1 1 

8) A detector gain for each set of vectors from step 7 may be 
found by solving equation (3.2.23). 

9) From 

G = A - DC (3.2.2) 

10) Let 

BF = B (3.3.6) 


The line characteristic of a failure in the i actuator is given by 


If there are other detection filters, they will produce error 
signals if a failure in the i^ actuator occurs, but they will not 
lie in a fixed direction, or they will not lie in a direction for 
which the filter was designed. 

This example E4 will demonstrate the design of a FDF for multiple 
actuator failures. The system will be the boiler system in example El. 
The eigenvalues of all the filters will be placed at ±.5. The system 
model is described by the matrices (2. 4. 6-8). 


1 0 


0 0 


A “ 


0 .77125 -.1796 0 

0 0 .61759 0 


(2.4.6) 


.1352 


.832419 


-.09633 


1 
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B 


15.84 1.3 

285.935 -7.65 

0 525.812 

140.98 6.998 


-1.3 

2679.275 

-21032.44 

893.619 


C - 


1 

3 

2 


1 

1 

1 


0 

0 

1 


1 

1 

1 


The filter design is below. 

1) Check all Cb^ and 


Cb J _ + 0 


so go to next step . 

2) Form F 


F 


15.84 

285.935 

0 

140.98 


1.3 -1.3 

-7.65 2679.275 

525.812 -21032.44 

6.998 813.619 


(2.4.7) 


(2.4.8) 


(3.3.7) 


(3.3.8) 


3) The rank of CF is 3 therefore F is output separable. 

4) Determine the maximal generators for f^ f 2 and f 3 and they are 


15.84 

285.935 

0 

140.98 


(3.3.9) 
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(3.3.10) 


(3.3.11) 

The detection order, v. , of all three vectors is one. 

l 

Steps 5) and 6) are simple equation evaluations and will not be shown 
here; however, the main result of steps 5) and 6) is 

qg' - 0 (3.3.12) 

7) The group detection order is four and the sum of the individual 
detection orders is three. Therefore, one eigenvalue will 
not be under the control of the designer if the PDF is 
designed with F. So the set is subdivided into two sets 

F 1 “ {f l’ f 2 } (3.3.13) 

F 2 = {f 3 > (3.3.14) 

The group detection order of F^ is two and the sum of the 
individual detection orders is two. Therefore, all the 
eigenvalues of A-DC are under the control of the designer. 

For the rest of the design, only F^ will be considered. 


S 3 “ f 3 = 


-1.3 

2679.275 

-21032.44 

893.619 


f 2 = 


1.3 

-7.65 

525.812 

6.998 
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8) Find the detector gain for realizing that two eigenvalues 
must be constrained to make D a detector gain for F^ and two 
eigenvalues will be arbitrary. 

The values of P, . and in w,, and w,- are -.5, where wd, 
li 1/ dl az i 

is given by equation (3.2.25). 

The solution is 


D 


7.92 

.65 

77.5612 

-92.36 

0 

61.83 

310.65 

-40.61 


.001088 .001162 
-.000921 -.000979 


-.00007164 

.0019019 


+ 


-.42 0 0 

0 0 0 

0 0 0 

0 0 0 


53316 

-.4989 

.00138 

4989 

.46683 

-.00129 

00138 

-.00129 

0 


-.21591 

.2181 

8.8367x10 J 


.16941 

.1805 

-.18121 


-.05694 

-.06053 

.11759 


.37525 

.040075 

-.099485 


Form G 

.56143 

-.00279 

-.00009 

-.00229 

-.348617 

.60251 

.001616 

-.16874 

.00334 

-.00012 

.49999 

-.000124 

1.2433 

.1559 

.0031556 

.32349 


(3.3.15) 


(3.3.16) 


(3.3.17) 
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The eigenvalues of G are .4937, .4937, .5 and .5. 

10) Let 

BF = B (3.3.6) 

11) The line characteristic of a failure in actuator 1 is given 
by the vector 



442.775 

474.435 

_458.595 



1 

1.07 

1.04 


(3.3.18) 


(3.3.19) 


The characteristic vector for f^ is found similarly. 

The FDF that will detect a failure in actuator one or two is 
given by 


Z 1 (k+1) = GZ 1 (k) + Dy (k) + BuD(k) (3.3.20) 

where G is given by equation (3.3.17), D is given by equation (3.3.16) 
and B is given by equation (2.4.7). 

A failure in actuator one will cause, in the noiseless case, 

y (k) - C Z x (k) = e L (k) (3.3.21) 

.after all transients have settled out to lie on a line given by 
(3.3.19). Similar results can be derived for a failure in actuator 


two. 
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3.4 Failure Detection Filter Design for Sensor Failures 

This section is a step by step guide for designing FDF. The 
design algorithm is for a single sensor failure and is derived from 
(1) . The design of a filter for detecting multiple sensor failures 
will not be covered in this thesis because of the complexity of the 
algorithm. The detection of more than one sensor failure with one 
filter is developed in (1). 

A FDF for a sensor failure is designed by the following steps. 

1) Find f such that 

Cf * em^ (3.4.1) 

where em^ is defined by equation (3.1.30). 

2) Find g the maximal generator for f using the algorithm in 
Appendix A. 

3) Find A', C' and K using equations (3.2.11-13). 

4) Find 

f' - Af (3.4.2) 

5) One of the following must hold 

i) Af lies in the observable space of C’ with respect to A', 
ii) Af lies in the unobservable space of C* with respect to 
A' and any detection gain satisfying 

DCf - QD (3.4.3) 


is also a detector gain for Af. 
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6) If case ii holds, solve for D using equation (3.2.9). 

7) If case i holds, find g' , A" by repeating steps two and 
three replacing f with Af, C with C', and A with A'. 

8) Solve for QD'. Where QD' is formed by equation (3.2.10) 
with A replaced by A' and g replaced by g 1 . 

9) Solve for D' using the equation 

D' =■ QD ' [ (C ' Af ) T C ' Af ] _1 C 1 Af + 

D"{I-C'Af[(C'Af) T C'Af]" 1 C'Af} (3. 4. A) 

where D" is an arbitrary matrix. 

10) Solve for A'-D'C' noting that 

A-DC = A'-D'C' (3.4.5) 

and 

G - A'-D'C' (3.4.6) 

11) Solve for D 

D “ (A-G)(CC T ) _1 C T (3.4.7) 

12) Let 

BF = B (3.4.8) 

The plane characteristic of the failure of the i 1 "^ 1 sensor is given 
by the vectors em^ and C'Af. 

This example, E5, will demonstrate the design of a FDF for a single 
sensor failure. The system will be the boiler system of example El. 
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The eigenvalues of the filter will be placed at ±.5. The system model 
is described by the matrices (2.4. 6-8). 


1 

0 

0 

.1352 

15.84 

285.935 

0 

140.98 


0 

.77125 

0 

.832419 

1.3 

-7.65 

525.812 

6.998 

'110 
3 10 

2 11 


0 

•.1796 

.61759 

-.09633 


0 

0 

0 

1 


-1.3 

2679.275 

-21032.44 

813.419 

l“ 

1 
1 


The filter design is as follows: 
1) Solve for f in (3.4.1) 



(2.4.6) 


(2.4.7) 


(2.4.8) 


(3.4.1) 


(3.4.9) 
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-.5 


f 


1.5 


-.5 


0 


(3.4.10) 


2) The maximal generator, g, for f is 


-.5 


g ■ 


1.5 

-.5 

0 


(3.4.11) 


The detection order of f is one. 

3) Find A' and C 1 . K will not be found since it is unnecessary 
for this part. 


1.25 

.25 

0 

.25 

-.496675 

.274575 

-.1796 

-.496675 

.058795 

.058795 

.61759 

.058795 

•1.09399 

-.39667 

-.09633 

-.22919 


where from equation (3.2.10) is -.5 and 


C' - 


0 

3 

2 


0 0 0 
10 1 
111 


(3.4.13) 


4) Find Af which is f' 
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(3.4.14) 

5) Since 

C'Af + 0 (3.4.15) 

then Af lies in the observable space of A' with respect 
to C ? . 

6) Since case i holds, step 6 is skipped. 

7) Find g' 

(3.4.16) 

8) Find QD' 

(3.4.17) 


QD’ 


.243968 

-.587745 

.079686 

-.814229 


g* 


-.08647 

.006089 

.104733 

1.2292 


Af 


-.5 

1.24668 

-.308795 

1.22919 


9) Solve for D’ using (3.4.4). 
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D' 


.243968 

-.587745 

.079686 

-.814229 


Eo 


.421659 


. 50427 3 + 


0 

0 

0 

0 


1.65 

3.3 

0 

0 


0 

0 

0 

0 


1 0 
0 .58852 

0 -.4921 


0 

-.4921 

.41148 


(3.4.18) 


It should be noted that it takes two eigenvalues of (A-DC) to 
constrain the residue to a plane and therefore two are left 
arbitrary and were specified by D". 

10) Find A’-D’C’ 


ID 


.6889 -.1350 

1.7407 -.2706 

.5773 -.0151 

.3143 .5247 


A'-D'C = 


-.5939 

-1.7389 

-.1228 

.7572 


-.1350 

.5 

-.0151 
.3571 * 

1.0739 

1.694 

.0337 

-.3433 


-.6889 

-1.9203 

.04029 

-.41063 


Solve for D 

“*-.25 

.49709 

D ■ 

-.0589 

1.229 


(3.4.19) 


(3.4.20) 
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12) Let 


BF = B 


(3.4.21) 


The plane characteristic of a failure in sensor one is given by the 
vectors enu and C'Af 


em 




C'Af 


0 

.9757 


1.167075 


(3.4.22) 


(3.4.23) 


The FDF that will detect a failure in sensor one is given by 


Z 2 (k+1) - GZ 2 (k) + Dy (k) + Bu(k) (3.4.24) 

where G and D are given by (3.4.19) and (3.4.20). 

A failure in sensor one will cause, in the noiseless case. 


y(k) « CZ 2 (k) » e 2 (k) (3.4.25) 

after transients have settled out to lie in a plane given by the 
vectors (3.4.22) and (3.4.23). Failure detection filters to detect a 
failure in sensors two and three are found similarly. 
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3.5 Configuration Estimation Technique 


The first part of the chapter is concerned with developing a FDF 
that will constrain the filter residue to a predictable line or plane 
if there is a failure which the filter is designed to detect. In this 
section a decision technique is developed which gives the probability 
that a noisy plant output is associated with a particular line or 
plane. 

Moose and Wang (13) demonstrated a decision technique that detects 
random configuration changes in the presence of noise. The decision 
algorithm is given below. 


n(k+l) 


P 1 (r 1 (k+1)). . . . 0 



lm 


n(k) (3.5.1) 


0 


. .. p (r (k+1) ) 
m m 



0 

mm 


where 



is a semi-Markov transition probability and where 


P i (r i (k+1)) - Pi (y(k+l))|s(k+l) = S i (k),y(k)) (3.5.2) 

where p^(y (k+1) ) | S (k+1) =■ S^(k),y(k)) is approximated to be a Gaussian 
density function and where S^(k) is the i C ^ configuration at time t=k. 
Since p^r^k+l)) is a Gaussian density it is given by 

P 1 (r i (k+1)) - D ± exp{-l/2 r^k+l) V^ 1 r^k+1)} (3.5.3) 


where V.^ is the covariance of a filter perfectly matched to the plant 
and where the constant D.^ is defined by 
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D ± = (2n)' m/2 |v i | 1/2 (3.5.4) 

It is assumed for this development that equation (3.5.2) can be 
approximated as a Gaussian density as it was in (13) . Using this 
assumption, the only unknown parameters of (3.5.1) and (3.5.3) are 
0^, the semi-Markov transition probabilities, r^(k+l), the plant 
output minus the Kalman filter output in (13), and V^, the covariance 
of the residue r^(k+l) when the filter is perfectly matched to the 
plant configuration. 

The semi-Markov transition probability 0 ^ is the probability 
that the plant will change from configuration to configuration . 
An excellent discussion of how to choose the semi-Markov parameters 
is in (14) . 

The residue r^(k+l), as stated above, is in (13) the plant output 
minus the Kalman filter output. In three dimensional output space, 
the residue r^(k+l) is the minimum distance between two points in 
output space. Therefore, the algorithm is actually dependent on the 
min imum distance between two points in the output space. 

Since the algorithm developed in (13) is minimum distance 
dependent, it follows that the algorithm can be extended to be the 
minimum distance between the filter residue point and a line or a 
plane, and the algorithm can be used to compute the probability that 
a filter residue is associated with a line for actuator failures or 
a plane for sensor failures. The modified algorithm is called the 
line or plane detection algorithm or LOPDA. 
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The value r\ (k+1) must be the minimum distance between the plant 
output and the predicted line or plane. The minimum distance is 
computed by least squares using the formula 

S T S x = S T b (3.5.5) 


where 

S is the set of vectors [S^» needed to describe the plane 

associated with the i C ^ sensor failure or the vector [S^] 
needed to describe the line associated with the i^ 
actuator failure, 
b is the residue e^(k+l) 

x is the solution to (3.5.5) 

The minimum distance is calculated 


r.(k+l) 


X l* S li + X 2* S 2i 



where e i (k+l) is defined 


e i (k+l) - y(k+l) - CZ^k+1) 


(3.5.6) 


(3.5.7) 


The final unknown in equation (3.5.1) and (3.5.3) is the 
covariance V^. The mean is also calculated to show that the predicted 
line or plane is the mean of a FDF residue where the plant is in a 
failure state the FDF is designed to detect. The plant is described 
by equations (2. 2. 1-2) and the i^ FDF is given by 


(k+1) * Gc^(k) + Dy(k) + Bu(k) 


(3.5.8) 
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where 

G = A-DC (3.1.2) 


The following definitions are made to simplify the mean and 


variance 

calculations. 



xd(k) » Ax(k) + Bu(k) 

(3.5.9) 


yd(k) « Cxd(k) 

(3.5.10) 


zd(k+l) ■ (A-DC)zd(k) + Dyd(k) + Bu(k) 

(3; 5. 11) 


d(k+l) - yd(k+l) - Czd(k+1) 

(3.5.12) 

The vector G is defined as any vector which lies in the predicted 
direction or plane for an actuator or sensor failure respectively. 
The expected value of e(k+l) is 

E{e(k+1)} * E{y(k+1) - Cz(k+1)} 

(3.5.13) 


= E{C[Ax(k) + Bu(k) + Gu(k)] + Hw(k) - 
C[A-DC)z(k) + Dy(k) + Bu(k)]} 

(3.5.14) 


= E{yd(k+1) - C[A-DC) z(k) + Dyd(k) + Bu(k)] + 
CGv(k) + Hw(k) - CD [CGv(k-l) + Hw(k-l)]} 

(3.5.15) 


= E{ed(k+1)} + E{CGv(k) + Hw(k) - 
CD[Gv(k-l) + Hw(k-l) ] } 

(3.5.16) 


- E(ed(k+1) } + 0 

(3.5.17) 
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The term ed(k+I) is the FDF residue with no noise. Therefore, it can 
be concluded that 


E{e(k+1) } - r (3.5.18) 

The steady state variance of e(k+l) is 
E(e(k+1) e T (k+l) } - E{[y(k+1) - Cz(k+1) ] [y (k+1) - Cz(k+1)] T ) (3.5.19) 

- E{ (C[Ax(k) + Bu(k) + Gv(k)] + 

Hw(k) - C[ (A-DC)z(k) + 

D[yd(k) + CGv(k-l) + Hw(k-l)] + Bu(k)]) 

( C[Ax(k) + Bu(k) + Gv(k) ] + 

Hw(k) - C[ (A-DC)Z(k) + 

D[yd(k) + CGv(k-l) + Hw(k-l) + Bu(k)]) T } (3.5.20) 

- E(( [yd (k+1) - Czd(k+1) ] + CGv(k) + Hw(k) - 
CD[CGv(k-l) + Hw(k) ] ) ( [yd (k+1) - Czd(k+1)] + 
CGv(k) + Hw(k) - CD [CGv(k-l) + Hw(k)]) T } (3.5.21) 

= E{ed(k+l)ed T (k+l)} + E{CGv(k) v T (k)G T C T + 
Hw(k)w T (k)H T - CD(CGv(k-l)v T (k-l)G T C T + 
Hw(k-l)w T (k-l)H T )} (3.5.22) 

n(k) in equation (3.2.1) is constant or slowly 
the variance will be approximately 

= CGQG T C T + HRH T - CD(CGQG T C T + HRH T )D T C T (3.5.23) 


At steady state if 
time-varying , then 

E[e(k+l)e T (k+l) ] 


where Q and R are the covariance of v(k) and w(k) respectively. 
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The failure detection part of the algorithm is complete and a 
failure can be detected using an equation of the form (3.5.1); 
however, the no failure case has not been discussed, For failure 
detection filters the no failure state is characterized by a zero 
residue because all FDF's track the plant state. Therefore, to 
detect the no failure state in the presence of noise, the distance 
from the residue point to zero r^k+1) is ^(k+1). It can easily be 
shown that if 

e i (k+l) =0 (3.5.24) 

the least squares algorithm in equation (3.5.5) will give 

x - 0 (3.4.25) 

Therefore, r^(k+l) will be the same for all values of i. To prevent 
this a failure threshold is set and the magnitude of x is not allowed 
to be less than the threshold. It can be shown that a FDF will always 
have a residue when a failure occurs even though it may not be in a 
fixed direction or plane. The probability of the no failed state is 
computed by letting any residue 

r x (k+l) *= e i (k+l) (3.5.25) 

and where r^k+1) is placed in equation (3.5.1) and Il^k+l) is the 
probability of the no failed state. 

To summarize the results of this section, the steps to determine 
if a failure has occurred in actuator one or two are given where 
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is the direction of the line characteristic of a failure in the i 1 "^ 1 
actuator. 

1) Find the semi-Markov transition matrix, set the threshold and 
find the covariance for the i C ^ residue and D^. 

The following steps must be completed each iteration. 

2) Find the plant output y(k+l). 

3) Find the FDF outputs z^(k+l). 

4) Find the FDF residue e^(k+l). 

5) Calculate r^(k+l), the minimum distance between the plant 
output and or, for the no failure case, P^(k+1) is e^(k+l). 

6) Calculate p i (r i (k+l) ) . 

7) Calculate JI(k+l) the probability of a failure in actuator l 


or a no failure state. 



4. SIMULATION AND RESULTS 


The purpose of this chapter is to exercise the theory developed in 
the previous two chapters and show their merit. This will be done by 
computer simulation. First, the B737 aircraft is simulated using the 
model developed by Zwicke, et al., to show that the estimator part 
of the control algorithm can adapt to a sensor failure, and the results 
are discussed in Section 4.1. Then the boiler system developed in 
example El is simulated with actuator and sensor failures using the 
two detection techniques developed, the Kalman filter technique 
developed in Chapter 2 and the FDF technique developed in Chapter 3. 

The boiler system simulations were designed to find what types 
of failures the failure detection techniques can detect and how they 
respond to modeling errors and sensor noise. The following types of 
actuator and/or sensor failures were considered. 

1) Biases on the actuator or sensor. 

2) Zero failures, i.e. no input from an actuator or no output 
from a sensor. 

3) Soft failures, i.e. increased noise on sensors. 

The results of these simulations are discussed in Sections 4.2 and 4.3. 

4.1 B737 Simulation and Results 

The B737 model with the linearized measurement model was simulated 
in the presence of sensor noise. The sensor noise covariance is gotten 
from (14) . The only types of failures simulated are zero failures of 
a sensor. 
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The aircraft is started below the glideslope and below the target 
speed. The failure of sensor one occurs at T=6 seconds. Figure 1 
shows that the estimator did determine with a high degree of certainty 
that a failure did occur. Figure 2 shows that the plane does stay on 
the glideslope even after the sensor failure and the aircraft per- 
formance is very good. 

As a result of the simulations, it has been shown that the control 
algorithm adapts quickly to a sensor failure as long as (A,C) remains 
an observable pair. The simulations also show that the estimator 
part of the controller has good noise rejection; but as expected, 
performance is degraded as sensor noise increases. A major point 
that should not be overlooked is the fact that all possible failures 
must be modeled. 

4.2 Kalman Filter Technique Simulation and Results 

The boiler system developed in example El was simulated for both 
actuator and sensor failures using the Kalman filter technique devel- 
oped in Chapter 2. 

The different types of actuator failures simulated include large 
and small bias and a zero failure under a variety of sensor noise 
levels. The failures were simulated for two types of desired inputs. 
They were a step input and a ramp input. This was done to see if the 
type of input affected the failure detection. For all these conditions 
the Kalman filter technique quickly and accurately identified the 
failure even in the presence of sensor noise. Figure 3 is typical 



Y AXIS 


8 



T I ME SECONDS 


Figure 1. Configuration probabilities for B737. 
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showing a correct identification of the no failed state and the failed 
actuator (actuator 2) . 

Actuator failures were also simulated in the presence of modeling 
error. This was done by changing one or all of the eigenvalues of the 
plant by a known value from the model the Kalman filter was using. In 
this, too, the Kalman filter approach did extremely well. Figure 4 is 
typical showing the identification of a failure in actuator one when 
there is a 5% change of all the eigenvalues. This method showed good 
tolerance for modeling error but the performance of the decision 
algorithm was degraded as the number of changed eigenvalues increased 
and as the percent error increased. 

The different types of sensor failures simulated were large and 
small biases on a sensor and a zero output, all of these under a 
variety of sensor noise levels. The failures were simulated for two 
types of inputs, a step and a ramp. The failure detection was not 
affected by a change in inputs. For all the different types of 
failures, the failure detection technique worked extremely well even 
in the presence of sensor noise; however, this technique will not 
detect soft failures in sensors. For all other cases, the no failed 
state was quickly identified and the failure state was identified soon 
after the failure occurred even in the presence of sensor noise. 

Figure 5 is typical showing the identification of the no failed state 
and the identification of the sensor failure after a short false 
identification. 

Sensor failures were also simulated in the presence of modeling 
error just as the actuator failures were. In this case too, the 
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Figure 3. Actuator failure detection with sensor noise 
by Kalman filter technique. 
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Figure 4. Actuator failure detection 
by Kalman filter technique. 
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Figure 5. Sensor failure detection w: 
by Kalman filter technique. 
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failure detection technique quickly identified the failure even when 
there was a 10% modeling error in all the eigenvalues . Figure 6 is 
typical showing the identification of a failure in sensor one when 
all the eigenvalues of the Kalman filter are incorrectly modeled by 
10%. Again as the number of eigenvalues incorrectly modeled increased 
and the percentage error increased, the performance was degraded but 
the degradation was not noticed until all the eigenvalues were changed 
more than 10%. 

In summary, the Kalman filter detection technique developed in 
Chapter 2 works extremely well for a wide range of actuator and sensor 
failures except soft failures. Also, changing the system input seemed 
to have no effect on failure detection. This method also worked well 
in the presence of sensor noise and when there was significant modeling 
error. The major disadvantage of this method of failure detection is 
that every failure must be modeled and all the models must be run in 
parallel which can become overwhelming computationally. 

4.3 Failure Detection Filter Technique Simulation and Results 

The boiler system in Chapter 2 was also simulated for both actuator 
and sensor failures using the FDF technique developed in Chapter 3. 

The different types of actuator failures simulated included large 
and small biases and zero failure of an actuator, all of these both with 
and without sensor noise. The failures were also simulated with the 
desired inputs being either a step or ramp . The no failure state and 
failures were identified regardless of the input, as long as the residue 
was large enough to exceed the threshold, for large and small biases 
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Figure 6. 


Sensor failure detection with 10% modeling error 
on all eigenvalues by Kalman filter technique. 
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and zero inputs when there was no sensor noise. Figure 7 is typical 
showing the no failure state correctly identified and a failure in 
actuator one being correctly identified when a small bias is applied 
to the actuator. However, when sensor noise is added, the performance 
was poor for all cases except for very low noise levels. This was not 
totally unexpected because the FDF was not optimized for performance 
in noisy environments; however, the no failure configuration is 
extremely unreliable. This is primarily due to the difficulty of 
determining the threshold which distinguishes the no failure state 
from the failure state. The threshold must be changed whenever the 
magnitude of the failure becomes small or the sensor noise level 
changes which makes this technique for identifying the no failure 
configuration very difficult to implement. Figure 8 shows a correct 
identification of the no failure configuration and a small bias failure 
for actuator two; however, the SNR was in the order of 10000:1. With 
noise levels greater than this, the technique could not distinguish 
the no failure case with any reliability. 

The actuator failure was also simulated in the presence of 
modeling error. Unlike the Kalman filter technique, the FDF technique 
is very sensitive to modeling error. The largest modeling error that 
the FDF technique could consistently tolerate and still identify the 
no failure and failure configurations was about 5% in one eigenvalue. 
Figure 9 shows the identification of the no failure configuration and 
the failure of actuator one in the presence of a 5% modeling error of 
one eigenvalue. 
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Figure 8. Actuator failure detection with sensor noise 
by failure detection filter technique. 
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Figure 9. Actuator failure detection with 5% modeling error on 
one eigenvalue by failure detection filter technique. 
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The different types of sensor failures simulated were large and 
small biases of a sensor, a zero failure and increased noise on a 
sensor. Each of these failures were simulated with various amounts 
of sensor noise and both step and ramp inputs. The failure detection 
technique was not affected by the type of failure as long as it created 
a residue large enough to exceed the failure threshold. The failure 
detection technique was also impervious to changes in the input; 
however, low level sensor noise did cause the performance to degrade 
significantly. The no failure detection technique was very sensitive 
to low levels of noise which made it useless. The failure detection 
technique was also sensitive to sensor noise but to a much lesser 
degree. Figure 10 shows the detection of the no failure state and a 
failure of sensor 3 when there is no sensor noise. Figure 11 demon- 
strates that the no failure state is unreliable when sensor noise is 
present. The no failure configuration is identified as a failure in 
sensor 3. The failure configuration in Figure 11 is quickly and 
correctly identified. The FDF technique will detect a soft failure in 
a sensor as shown in Figure 12. Again note that the no failure con- 
figuration identification does not give any reliable information. 

Sensor failures were also simulated in the presence of modeling 
error. The results were disappointing because the FDF technique shows 
no tolerance for any modeling error. Figure 13 shows a failure in 
sensor one at t**760 seconds which is incorrectly identified as a 
failure in sensor three when there is a 1% modeling error in one 
eigenvalue. This result should not be surprising because the FDF 
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Figure 10. Sensor failure detection with 
detection filter technique. 
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Soft sensor failure detection by failure detection 
filter technique. 
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Figure 13. Sensor failure detection with 1% modeling error on one 
eigenvalue by failure detection filter technique. 
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developed by Beard can also be designed to detect changes in the A 
matrix. A change in the plant will cause a random error in all the 
filter residues in addition to any error associated with a failure 
and therefore may cause an incorrect identification. 

In summary, the failure detection filter technique can detect a 
large number of failures with various inputs in the presence of noise. 
This technique can also detect soft failures in sensors. These bene- 
fits are overshadowed by the disadvantages. The no failure detection 
technique is very sensitive to sensor noise and small levels of sensor 
noise make it unreliable. Also, the FDF technique is also very sensi- 
tive to small changes in the eigenvalues . 



5. CONCLUSIONS 


This report is intended to show that the estimator part of the 
control algorithm developed by Zwicke, et al. for the B737 can adapt 
to sensor failures. In addition it is intended to explore potential 
usefulness of the Kalman filter identification technique adapted from 
the estimator of the B737 control algorithm and the FDF technique 
developed in this thesis for failure detection in the B737 project. 

The B737 control algorithm is shown to work well during a sensor 
failure in the presence of sensor noise; however, the main disadvantage 
is that all failure modes must be modeled which can make this technique 
hard to implement. 

The Kalman filter technique presented in Chapter 2 has some 
major advantages over the FDF technique present in Chapter 3. First 
the Kalman filter technique works extremely well in the presence of 
sensor noise. Also, small modeling errors do not affect the perform- 
ance of the technique. This is a major concern for this particular 
application since the plant models are linearized and will seldom be 
a perfect match to the actual plant. This failure detection technique 
does require a model for each failure mode which can make detection 
unwieldy. 

The FDF technique presented in Chapter 3 also has advantages but 
they are outweighted by the technique’s limitations. The FDF technique 
can detect a wide range of failures including soft failures with a 
small number of filters. This technique can also distinguish between 
a zero input and the zero failure of an actuator. Failures are 
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detected with reliability quicker than they are using the Kalman 
filter technique; however, the no failure configuration detection 
technique developed in Chapter 3 is not satisfactory because the 
failure threshold is difficult to set when sensor noise is present. 
The most serious problem with this failure detection technique is 
that the plant models must be too accurate to allow for the estimated 
parameters and the changes in the plant as the plane goes through 
its flight envelope. 

In summary, the failure detection filter technique as it is 
presented in this thesis can not provide reliable failure detection 
for the B737 primarily because of its need for an extremely accurate 
plant model. The Kalman filter technique although cumbersome to 
implement can accurately detect actuator or sensor failures for this 


type of system. 



6. RECOMMENDATIONS FOR FURTHER STUDY 


It is hoped that this jreport will not be the end of research in 
this area, but will be a continuing part of the research effort in the 
flight control and failure detection areas. The following areas are 
recommended for further study. 

First, the B737 model developed by Zwicke, et al. was not designed 
considering the possibility of actuator and sensor failures. Therefore, 
the model needs to be modified so that all the information necessary 
for control of the aircraft is still available after any sensor failure. 

In addition to the work needed on the failure model, the Kalman 
filter detection technique used in the B737 project needs further study. 
Since the Kalman filter approach requires a failure model for each 
failure and there are almost an infinite number of ways actuators and 
sensors can fail (bias of 10%, 11%, etc.), there needs to be a deter- 
mination of how accurate each failure model must be and how many 
similar failures can one model detect. 

The failure detection filter technique developed in this thesis 
also needs further study. First and foremost, a better no failure 
configuration detector needs to be developed. A hybrid system using 
the Kalman filter technique for the no failure state detection and the 
FDF technique to detect failures appears to be a promising approach. 

In addition, in the FDF technique an assumption that equation (3.5.2) 
could be approximated by a Gaussian density function was made. This 
should be investigated further to see if the assumption is indeed 
valid and if a "better" approximation may be found. 
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Finally, this report has shown that the FDF technique works 
extremely well. However, the classes of problems for which this 
technique is applicable are severely restricted. Therefore, FDF 
theory needs to be extended so that it can be applied to nonlinear 
and time varying systems. 
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APPENDIX A. FINDING THE MAXIMAL GENERATOR 


The algorithm for finding the maximal generator is developed by 
Beard (1) and a brief synopsis is presented in this appendix. The 
algorithm depends on the orthognal reduction process and it is reviewed 
before the maximal generator algorithm is given. 

The orthognal reduction of an n*n positive definite matrix ft by 
the rows of an n*n matrix V, where 

(A-l) 

and are n*l arbitrary vectors, generates a matrix ft^ whose range 
space coincides with the null space of V. The n*n matrix ft^ is found 
by the following steps. 

1) Any auxiliary vector to^ is defined by 

«1 - ft 1 V 1 (A-2) 

where ft 1 is the positive definite matrix ft. 

2) Solve the following equation for ft ^ 

T 

to. to. 

s 2 ■ n i - (A ‘ 3) 

“i v i 

3) The following steps are iterative 

i) With ft^ from the previous iteration, form the 
auxilary vector. 
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ii) If uk j 1 0, then solve the following equation for $2 ^ 


Vi 

B i + 1 * ^i ~ T~ 


(A-4) 


“i V i 


iii) If o)^ * 0, then set 


n i+l " n i 


(A-5) 


This orthognal reduction process is completed if all n rows of V have 
been processed. 

The algorithm for finding the maximal generator is given by the 
following steps. 

1) Find M' , and where M' is given by equation (3.2.14) and 
where 

(A-6) 

where q' is defined by equation (3.2.16). 

2) Form the starting matrix 

B ■ *nx„ (A - 7) 

3) Perform the orthognal reduction of fi by the rows of M' . 

4) When the reduction process is complete, is the range 
scale of f. 

The next four steps are for finding the maximal generator. 


\t 


C 

CK 


CKn ^ 1 
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5) Reduce by the rows of M^. All the auxiliary vectors of 

will be zero except for one. 

6) The maximal generator is formed by the last nonzero auxiliary 
vector before termination, given by the equation 


«i “ Vc /- 1 ) 1 


(A-8) 


di 

where v is the detection order of f and is the j row 
of C. 

7) The magnitude of must be adjusted to satisfy 


CA V_1 g - CA U f 


(A-9) 


where u is defined by 

CA^ f = 0 j » 0 u-1 

CA U f j 4 0 


8) The maximal generator g is 


g 


C j AUf 


in. 


(A-10) 
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